<p>This rule is deprecated, and will eventually be removed.</p>
<p>Using sockets is security-sensitive. It has led in the past to the following vulnerabilities:</p>
<ul>
  <li> <a href="https://www.cve.org/CVERecord?id=CVE-2011-1785">CVE-2011-178</a> </li>
  <li> <a href="https://www.cve.org/CVERecord?id=CVE-2017-5645">CVE-2017-5645</a> </li>
  <li> <a href="https://www.cve.org/CVERecord?id=CVE-2018-6597">CVE-2018-6597</a> </li>
</ul>
<p>Sockets are vulnerable in multiple ways:</p>
<ul>
  <li> They enable a software to interact with the outside world. As this world is full of attackers it is necessary to check that they cannot receive
  sensitive information or inject dangerous input. </li>
  <li> The number of sockets is limited and can be exhausted. Which makes the application unresponsive to users who need additional sockets. </li>
</ul>
<p>This rules flags code that creates sockets. It matches only the direct use of sockets, not use through frameworks or high-level APIs such as the
use of http connections.</p>
<h2>Ask Yourself Whether</h2>
<ul>
  <li> sockets are created without any limit every time a user performs an action. </li>
  <li> input received from sockets is used without being sanitized. </li>
  <li> sensitive data is sent via sockets without being encrypted. </li>
</ul>
<p>There is a risk if you answered yes to any of those questions.</p>
<h2>Recommended Secure Coding Practices</h2>
<ul>
  <li> In many cases there is no need to open a socket yourself. Use instead libraries and existing protocols. </li>
  <li> Encrypt all data sent if it is sensitive. Usually it is better to encrypt it even if the data is not sensitive as it might change later. </li>
  <li> <a href="https://www.owasp.org/index.php/Input_Validation_Cheat_Sheet">Sanitize</a> any input read from the socket. </li>
  <li> Limit the number of sockets a given user can create. Close the sockets as soon as possible. </li>
</ul>
<h2>Sensitive Code Example</h2>
<pre>
const net = require('net');

var socket = new net.Socket(); // Sensitive
socket.connect(80, 'google.com');

// net.createConnection creates a new net.Socket, initiates connection with socket.connect(), then returns the net.Socket that starts the connection
net.createConnection({ port: port }, () =&gt; {}); // Sensitive

// net.connect is an alias to net.createConnection
net.connect({ port: port }, () =&gt; {}); // Sensitive
</pre>
<h2>See</h2>
<ul>
  <li> OWASP - <a href="https://owasp.org/www-project-top-ten/2017/A3_2017-Sensitive_Data_Exposure">Top 10 2017 Category A3 - Sensitive Data
  Exposure</a> </li>
  <li> CWE - <a href="https://cwe.mitre.org/data/definitions/20">CWE-20 - Improper Input Validation</a> </li>
  <li> CWE - <a href="https://cwe.mitre.org/data/definitions/400">CWE-400 - Uncontrolled Resource Consumption ('Resource Exhaustion')</a> </li>
  <li> CWE - <a href="https://cwe.mitre.org/data/definitions/200">CWE-200 - Exposure of Sensitive Information to an Unauthorized Actor</a> </li>
</ul>
